--- a/MozillaFirefox/MozillaFirefox.changes	Mon Sep 19 21:47:49 2016 +0200
+++ b/MozillaFirefox/MozillaFirefox.changes	Fri Sep 23 13:20:08 2016 +0200
@@ -1,4 +1,57 @@
 -------------------------------------------------------------------
+Tue Sep 20 07:09:52 UTC 2016 - wr@rosenauer.org
+
+- update to Firefox 49.0 (boo#999701)
+  new features
+  * Updated Firefox Login Manager to allow HTTPS pages to use saved
+    HTTP logins.
+  * Added features to Reader Mode that make it easier on the eyes and
+    the ears
+  * Improved video performance for users on systems that support
+    SSE3 without hardware acceleration
+  * Added context menu controls to HTML5 audio and video that let users
+    loops files or play files at 1.25x speed
+  * Improvements in about:memory reports for tracking font memory usage
+  security related
+  * MFSA 2016-85
+    CVE-2016-2827 (bmo#1289085) - Out-of-bounds read in
+    mozilla::net::IsValidReferrerPolicy
+    CVE-2016-5270 (bmo#1291016) - Heap-buffer-overflow in
+    nsCaseTransformTextRunFactory::TransformString
+    CVE-2016-5271 (bmo#1288946) - Out-of-bounds read in
+    PropertyProvider::GetSpacingInternal
+    CVE-2016-5272 (bmo#1297934) - Bad cast in nsImageGeometryMixin
+    CVE-2016-5273 (bmo#1280387) - crash in
+    mozilla::a11y::HyperTextAccessible::GetChildOffset
+    CVE-2016-5276 (bmo#1287721) - Heap-use-after-free in
+    mozilla::a11y::DocAccessible::ProcessInvalidationList
+    CVE-2016-5274 (bmo#1282076) - use-after-free in
+    nsFrameManager::CaptureFrameState
+    CVE-2016-5277 (bmo#1291665) - Heap-use-after-free in nsRefreshDriver::Tick
+    CVE-2016-5275 (bmo#1287316) - global-buffer-overflow in
+    mozilla::gfx::FilterSupport::ComputeSourceNeededRegions
+    CVE-2016-5278 (bmo#1294677) - Heap-buffer-overflow in
+    nsBMPEncoder::AddImageFrame
+    CVE-2016-5279 (bmo#1249522) - Full local path of files is available
+    to web pages after drag and drop
+    CVE-2016-5280 (bmo#1289970) - Use-after-free in
+    mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap
+    CVE-2016-5281 (bmo#1284690) - use-after-free in DOMSVGLength
+    CVE-2016-5282 (bmo#932335) - Don't allow content to request favicons
+    from non-whitelisted schemes
+    CVE-2016-5283 (bmo#928187) - <iframe src> fragment timing attack can
+    reveal cross-origin data
+    CVE-2016-5284 (bmo#1303127) - Add-on update site certificate pin expiration
+    CVE-2016-5256 - Memory safety bugs fixed in Firefox 49
+    CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4
+- removed obsolete patches:
+  * mozilla-aarch64-48bit-va.patch
+  * mozilla-exclude-nametablecpp.patch
+  * mozilla-old_configure-bmo1282843.patch
+- added patch mozilla-skia-overflow.patch (bmo#1304114)
+- requires NSS 3.25
+
+-------------------------------------------------------------------
 Tue Aug 30 20:25:38 UTC 2016 - astieger@suse.com
 
 - Mozilla Firefox 48.0.2: